AWS Console Root Login Without MFA
Rapport de recherche Datadog : Bilan sur l'adoption de l'informatique sans serveur Rapport : Bilan sur l'adoption de l'informatique sans serveur
<  Back to rules search

AWS Console Root Login Without MFA

cloudtrail

Classification:

compliance

Framework:

cis-aws

Control:

cis-3.2

Set up the cloudtrail integration.

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Overview

Goal

Detect when a root user logs into the AWS console without multi-factor authentication.

Strategy

Monitor CloudTrail and detect when any @evt.name has a value of Console Login, @userIdentity.type has a value of Root, and @additionalEventData.MFAUsed has a value of no.

Note: This rule ignores logins using SAML because 2FA is implemented on the IdP and not through AWS.

Triage & Response

  1. Reach out to the user to determine if the login was legitimate.
  2. If the login was legitimate, request that the user enables 2FA on the root account.
  3. If the login wasn’t legitimate, rotate the credentials.
  4. Review all root user accounts to ensure MFA is enabled.

Note: There is a separate rule to detect Login without MFA for non-root users.